John Dennis wrote:

I'm in the process of debugging a problem and it seems to me paircompare() (in src/main/valuepair.c) is returning the wrong result. But I might be ascribing the wrong semantics to the function. Here is what I think it's supposed to do, is this correct?

The semantics are... what's grown over time, to be compatible with the historical implementation of the "users" file.

If any check attribute matches (according to it's operator) any attribute of the same attribute type in the request then return 0 else return ~0.

Phrased another way it's a short circuit "logical or", e.g. as long as something matches it succeeds.

Pretty much.

If that is the intended semantics then I think there are couple of bugs in it and I'll provide a patch along with an explanation, otherwise could you set me straight on what it's behaviour is supposed to be?

I think the main issues are that (foo != bar) SHOULD be !(foo == bar), and it's not. They're different. I'll look at the patches, but I'm very wary of changing the functionality. There are 100,000 sites using this code, and I want to be sure any change will have limited effect. Alan DeKok.